When parsing a PKCS12 file, with a >= 1 GiB OCTET STRING (or BIT STRING) attribute on a SAFEBAG, via info() or info_as_hash(), a heap out-of-bounds write would be triggered with remote-code-execution potential (RCE) due to a signed integer overflow in the size calculation passed to Renew().
Analysis
Analysis and contextual insights are available on OpenCVE Cloud.
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | ||||||
|---|---|---|---|---|---|---|---|---|---|
| JONASBN | Crypt::OpenSSL::PKCS12 | unaffected |
|
No data.
No data.
| Vendor | Product | Confidence | Versions | ||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|
| Jonasbn | Crypt::openssl::pkcs12 | 100% |
|
Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .
Vendor Solution
Upgrade to 1.95 or later.
Vendor Workaround
Do not parse untrusted PKCS12 files via info or info_as_hash.
Tracking
Sign in to view the affected projects.
No advisories yet.
Mon, 18 May 2026 13:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Metrics |
cvssV3_1
|
Mon, 18 May 2026 11:15:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| First Time appeared |
Jonasbn
Jonasbn crypt::openssl::pkcs12 |
|
| Vendors & Products |
Jonasbn
Jonasbn crypt::openssl::pkcs12 |
Mon, 18 May 2026 00:15:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | Crypt::OpenSSL::PKCS12 versions through 1.94 for Perl have out of bound (OOB) write flaws. When parsing a PKCS12 file, with a >= 1 GiB OCTET STRING (or BIT STRING) attribute on a SAFEBAG, via info() or info_as_hash(), a heap-OOB-WRITE would be triggered which could have Remote Code Execution (RCE) potential. | Crypt::OpenSSL::PKCS12 versions through 1.94 for Perl have out-of-bounds (OOB) write flaws. When parsing a PKCS12 file, with a >= 1 GiB OCTET STRING (or BIT STRING) attribute on a SAFEBAG, via info() or info_as_hash(), a heap out-of-bounds write would be triggered with remote-code-execution potential (RCE) due to a signed integer overflow in the size calculation passed to Renew(). |
| Title | Crypt::OpenSSL::PKCS12 versions through 1.94 for Perl have out of bound (OOB) write flaws | Crypt::OpenSSL::PKCS12 versions through 1.94 for Perl have out-of-bounds (OOB) write flaws |
Sun, 17 May 2026 22:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
Sun, 17 May 2026 19:00:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | Crypt::OpenSSL::PKCS12 versions through 1.94 for Perl have out of bound (OOB) write flaws. When parsing a PKCS12 file, with a >= 1 GiB OCTET STRING (or BIT STRING) attribute on a SAFEBAG, via info() or info_as_hash(), a heap-OOB-WRITE would be triggered which could have Remote Code Execution (RCE) potential. | |
| Title | Crypt::OpenSSL::PKCS12 versions through 1.94 for Perl have out of bound (OOB) write flaws | |
| Weaknesses | CWE-787 | |
| References |
|
|
MITRE
Status: PUBLISHED
Assigner: CPANSec
Published:
Updated: 2026-05-18T12:55:51.157Z
Reserved: 2026-05-13T22:45:07.737Z
Link: CVE-2026-8507
Vulnrichment
Updated: 2026-05-18T12:55:46.046Z
NVD
Status : Deferred
Published: 2026-05-17T19:16:24.590
Modified: 2026-06-17T11:04:00.583
Link: CVE-2026-8507
Redhat
No data.
OpenCVE Enrichment
Updated: 2026-05-18T15:45:26Z